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Doing Business in the European Union 


US companies doing business in the EU face restrictions on the transfer of personal data out of the 
EU. While the US promotes the free flow of data and permits data transfers out of the US, the EU’s 
General Data Protection Regulation (GDPR)' does not allow companies to move personal data out 
of the EU, with few exceptions. 


What is the Privacy Shield? 


One important exception is the US-EU Privacy Shield Framework, which is used by big and small 
companies to enable transatlantic data flows. The Framework was developed by the Department 
of Commerce (“the Department”) and European Commission and went into effect on July 12, 2016. 
The Framework undergoes Annual Reviews by the US and EU governments to assess the efficacy 
of the Privacy Shield program and to ensure effective implementation of the agreement by both the 
EU and US. 


How Does the Privacy Shield Work’? 

US companies that wish to utilize the Privacy Shield do so on a voluntary basis. A company enrolls 
in the Privacy Shield program with the Department of Commerce and self-certifies and makes bind- 
ing commitments about the handling of personal data. Once the company’s application has been 
reviewed and accepted, it can move data into and out of and the EU. The company’s application 

to the Privacy Shield undergoes annual reviews by the Department of Commerce and EU for the 
duration of its participation in the program. 


Why Does the Privacy Shield Matter? 


As of August 2018, over 3,400 US companies trom nearly all 50 states are utilizing the Privacy 
Shield. These businesses are significantly contributing to the US’ nearly $1.1 trillion in total trade in 
goods and services with the EU.’ 
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It is important to note that over fifty percent of Privacy Shield participants are small- and medi- 
um-sized companies,’ meaning the benefits of the Privacy Shield go well beyond large, multination- 
al corporations. 


"httos://www.washingtonpost.com/news/the-switch/wp/201 8/05/25/why-youre-getting-flooded-with-privacy-notifications-in-your-email/?utm_term=.c4345e0e0979 
? US Trade Representative, European Union, https://ustr.gov/countries-regions/europe-middle-east/europe/european-union (last visited Aug. 3, 2018). 

3 US Department of Commerce, International Trade Administration, The EU-US and Swiss-US Privacy Shield Frameworks, https://www.privacyshield.gov/servlet/ 
serviet.FileDownload?file=015t0000000Qudg (last visited Aug. 3, 2018). 


Challenges to the Privacy Shield 


The Privacy Shield is facing criticism and challenges. Some policymakers in the EU are trying to 
upend this economic and job-creating pipeline. They argue that the US provides insufficient protec- 
tion and remedies for personal data coming from the EU. They also contend that the US is not fully 
implementing the framework. 


For example, the EU parliament recently passed a resolution arguing that the Privacy Shield should 
be suspended until the US fully implements the agreement.’ These issues will continue to elevate in 
the lead-up to the Privacy Shield annual review, which is scheduled for October 2018. 


The EU Commission is emphasizing the importance of two non-controversial implementation issues 
for the 2018 annual review, which are related to nominations. First, the need for a quorum of 
members of the five-person Privacy and Civil Liberties Oversight Board (PCLOB), which analyzes 
Executive Branch actions and policies to protect the nation from terrorism and ensures that privacy 
and civil liberties are considered in their activities. Second, the need for a senior, political appointee 
to the position of Under Secretary for Economic Growth, Energy, and the Environment at the State 
Department. This role includes the responsibility of serving as of Privacy Shield Ombudsperson 


BSA Recommendations 


Ey BSA urges Congress to confirm the following PCLOB nominees prior to the 
October 2018 Privacy Shield Review: Adam Klein (Chairman of the PCLOB), 
Aditya Bamzai, Edward Felten, Travis LeBlanc, and Jane Nitze. 


2) BSA urges the Administration to nominate a senior political appointee for the 
Under Secretary for Economic Growth, Energy, and the Environment at US 
state Department prior to the 2018 Privacy Shield review. 





* http://www.europarl.europa.eu/news/en/press-room/20180628IPR06836/suspend-eu-us-data-exchange-deal-unless-us-complies-by-1-september-say-meps. In 
addition, there are several court challenges to the Privacy Shield’s data protection standards underway in Europe. 
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